Live › vulnerability › CVE-2026-77938
Go to dashboardLetta through 0.16.8 runs tool code in LocalSandbox subprocesses that inherit the full server environment. A user who can run tools can read LETTA_PG_URI, POSTGRES_PASSWORD and provider API keys, then reach cross-tenant database data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments of Letta through 0.16.8 where users can run tools, through the tools run endpoint or custom tools, on the local sandbox. The exposure depends on whether untrusted or multi-tenant users can execute tools; single-tenant deployments with only trusted operators carry less risk. unknown whether a remote sandbox setup is affected.
No product ranges from the sources yet.
letta --version or the image tag; versions through 0.16.8 are listed as affected.POST /v1/tools/run or custom tools are enabled for non-admin users.LocalSandbox use in the deployment (default local sandbox, not a remote one).0.16.8; the sources do not name the fixed version, so check the release notes.LETTA_PG_URI, POSTGRES_PASSWORD and provider API keys.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Letta through 0.16.8 contains an information disclosure vulnerability that allows users running tools to read server secrets because LocalSandbox subprocesses inherit the full server environment. Attackers can run code via POST /v1/tools/run or custom tools to read LETTA_PG_URI, POSTGRES_PASSWORD, and provider API keys, then access cross-tenant database data.
This page as .md · .json · in your agent: get_signal("CVE-2026-77938")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.